Provenance in Determinate Nix

Determinate Nix has a provenance command that enables you to:

• View the provenance of a store path using the nix provenance show command
• Verify the provenance of a store path using the nix provenance verify command

Enabling provenance

Provenance tracking is gated behind the provenance experimental feature. To use the nix provenance commands, enable that feature in your nix.custom.conf file:

extra-experimental-features = provenance

If you’re on macOS and manage your system with nix-darwin, you can instead set extra-experimental-features using the determinateNix.customSettings attribute in the determinate nix-darwin module:

customSettings = {
  extra-experimental-features = "provenance";
};

Show provenance

The nix provenance show command in Determinate Nix displays the provenance chain behind a store path (you can also supply a flake reference that resolves to a store path).

Here’s an example:

nix provenance show \
  $(nix build --print-out-paths "https://flakehub.com/f/NixOS/nixpkgs/=0.2511.909025#ponysay")

You should see output like this (if you’re using cache.nixos.org as a cache, which Determinate Nix does by default):

/nix/store/c0fnfby2hvzkbf768hcryvj4yy9xahpa-ponysay-unstable-2021-03-27
← copied from https://cache.nixos.org

Verify provenance

The nix provenance verify command in Determinate Nix verifies two things about a store path (you can also supply a flake reference that resolves to a store path):

1. That all of the derivation’s sources are currently available.
2. That evaluating the derivation using the fetched sources results in the same .drv file as the derivation currently in the Nix store.

This command, for example, would verify the provenance of a NixOS system closure:

nix provenance verify /run/current-system

The output could look something like this:

/nix/store/bwmc8dmbf01b07sgzfa48f5y5dgj48am-nixos-system-machine-25.11.20260214.3aadb7c
✅ fetched tree 'git+file:///my-repo?ref=refs/heads/master&rev=f6ba198ac4c8010cb0879978541189f201b734f1'
✅ evaluated 'git+file:///my-repo?ref=refs/heads/master&rev=f6ba198ac4c8010cb0879978541189f201b734f1#nixosConfigurations.machine.config.system.build.toplevel'
✅ re-instantiated path '/nix/store/qi4z9bg89sxjrs5ar11627hgwjiv42m3-nixos-system-machine-25.11.20260214.3aadb7c.drv'
✅ rebuilt derivation '/nix/store/qi4z9bg89sxjrs5ar11627hgwjiv42m3-nixos-system-machine-25.11.20260214.3aadb7c.drv^out'

In this case, Determinate Nix confirms that the sources are all available and that the resulting .drv file is the same as the one currently in the Nix store; if the sources weren’t available or the .drv files differed, verification would fail.

You can also use the command with any store path or flake reference. Here’s an example:

nix provenance verify \
  $(nix build --print-out-paths "https://flakehub.com/f/NixOS/nixpkgs/=0.2511.909025#ponysay")